What is PhantomProxy?
PhantomProxy is a lightweight, cyberpunk-themed HTTP traffic inspector built as a Manifest V3 browser extension for Microsoft Edge and Chrome. It is aimed at developers, security researchers, and bug bounty hunters who want a Burp-inspired proxy → history → repeater → intruder loop without leaving the browser.
Traffic is observed through the browser’s own APIs. You do not configure a system proxy, install a CA certificate for TLS interception, or run a separate desktop Java stack for day-to-day request review and replay.
Current public toolkit version: v2.3.0 (released 11 July 2026) — scope, intercept, history, repeater, intruder, tools suite, and decoder.
Features (v2.3.0)
Scope
Domains, wildcards (*.example.com), path patterns, regex. DIM or HIDE out-of-scope traffic. Persists across sessions.
Intercept
Hold, edit, forward, or drop live requests. Debugger mode + page-hook for fetch/XHR. POST-safe pure forward.
History
Live capture, rich filters, auto FLAGS (JWT, AUTH, ADMIN…), bookmarks, HAR export/import, send to Repeater.
Repeater
Multi-session tabs, headers/body/raw, cURL import, pretty JSON/XML responses, send to Intruder.
Intruder
Position markers, sniper / pitchfork / cluster, wordlists, grep on results — fuzz without leaving the panel.
Tools
Sitemap, search, compare, match/replace, params, cookie jar, issues, WebSocket client, JWT editor, projects.
Decoder
Base64, URL, HTML, Hex, JSON format, JWT decode, SHA-256. Chain mode for multi-step transforms.
Standalone
Toolbar EXECUTE opens a full window — ideal for a second monitor or focused intercept sessions.
| Area | Capabilities |
|---|---|
| Scope | Domains, wildcards, path patterns, regex, DIM/HIDE, ADD ALL FROM HISTORY |
| Intercept | Hold/edit/forward/drop; debugger + page-hook; F/D shortcuts; in-scope-only option |
| History | Live capture, filters, bookmarks, notes, HAR, auto FLAGS, compare A/B |
| Repeater | Multi-session, cookies, cURL import, pretty body, FUZZ → Intruder |
| Intruder | § positions, sniper/pitchfork/cluster, wordlists, result grep |
| Tools | Sitemap, search, compare, match/replace, params, cookies, issues, WS, JWT, project |
| Decoder | Base64/URL/HTML/Hex/JSON/JWT/SHA-256 + chain mode |
Installation
Microsoft Edge Add-ons
Search for PhantomProxy on the Microsoft Edge Add-ons store and install from there when available.
Load unpacked (Developer Mode)
- Clone or download the repo: github.com/thevillagehacker/Phantom-Proxy
- Open
edge://extensions/orchrome://extensions/ - Enable Developer Mode
- Click Load unpacked and select the project root (folder containing
manifest.json) - Open any page → press F12 → open the PhantomProxy DevTools tab
Standalone window
Click the PhantomProxy toolbar icon → EXECUTE to open a dedicated window. Use TARGET TAB to choose which browser tab to monitor (or all tabs). Standalone is recommended for intercept (debugger mode) and multi-monitor workflows.
Core workflows
History capture
Requests are captured passively via webRequest as soon as the panel is open. Filters
cover free-text URL search, method chips, status bands, multi-select resource types,
IN SCOPE ONLY, and HIGHLIGHTED ONLY. Right-click rows to bookmark with color + note.
Auto FLAGS badge interesting traffic: JWT, API KEY, AUTH, ADMIN, SENSITIVE, UPLOAD, 403, 5xx, SQL?, GraphQL, WS — useful for triage without manual grepping.
Repeater
Send any history row to Repeater, or paste cURL. Multi-session tabs keep last responses.
Response viewer supports RAW/PRETTY (JSON + XML), headers, copy, and wrap. Keyboard:
Ctrl+Enter to send.
Intercept
Live hold of requests for edit/forward/drop. Debugger mode covers broad HTTP; page-hook
mode targets fetch / XHR while DevTools is open. Pure Forward preserves original POST
bodies (including FormData); edited forwards recompute Content-Length.
Intruder / fuzz
Mark payload positions, choose attack mode (sniper / pitchfork / cluster), load wordlists, and grep results — without exporting to an external fuzzer for many day-to-day checks.
Architecture
phantom-proxy/
├── manifest.json # Manifest V3
├── background/worker.js # Capture, repeater fetch, keepalive
├── content/ # Intercept bridge / page hook
├── devtools/ # Registers DevTools panel
├── panel/ # Full UI (history, repeater, tools, theme)
├── popup/ # Toolbar popup → standalone window
└── icons/How capture works (simplified):
Page request
→ onBeforeRequest / onSendHeaders / onHeadersReceived / onCompleted
→ requestStore (≤500 in memory)
→ broadcastToDevtools (port to panel / standalone)
→ History row
Repeater send → background fetch() (avoids panel CORS limits)Security design
- No data leaves the browser — capture stays in local memory; no analytics server
- SSRF guards — Repeater blocks
file://,javascript:, and private IP ranges - CRLF stripping on header names/values before use
- XSS-safe rendering — server-controlled fields via
textContent/ DOM APIs, not raw HTML injection - Prototype pollution guards on header maps
- HTTP method whitelist in Repeater
- Body size caps — capture truncate ~64 KB; repeater responses capped ~2 MB
Permissions
| Permission | Why |
|---|---|
webRequest | Observe HTTP traffic (core) |
tabs / windows | Tab association; standalone window |
storage | Scope + bookmarks persistence |
scripting / debugger | DevTools integration & intercept modes |
webNavigation | Navigation lifecycle |
cookies | Cookie jar / header workflows |
<all_urls> | Observe arbitrary test targets |
Notes & limits
- Requires Edge 88+ or Chrome 88+ (MV3 +
webRequest) - Response bodies are not fully available from passive
webRequestalone — use RES PRETTY re-fetch or Repeater - Default capture path is observation + active replay; intercept modes add hold/edit/forward/drop
- Works on
http://andhttps://pages; extension pages (chrome://,edge://,devtools://,file://) are excluded
Privacy
PhantomProxy is designed for local research: no telemetry, no tracking, no cloud sync of captured traffic. Full policy: PhantomProxy Privacy Policy.
Links
- Source: github.com/thevillagehacker/Phantom-Proxy
- Release notes: RELEASE.md (v2.3.0)
- Usage guide: USAGE.md
- Privacy: on this site